Request for information

Introduction

This procedure document supplements the subject access request (SAR) provisions set out in Concept Personnel Limited’s (hereinafter referred to as the “Company”) Data Protection Policy & Procedures and provides the process for individuals to use when making an access request, along with the protocols followed by the Company when such a request is received.

The Company needs to collect personal information to effectively and compliantly carry out our everyday business functions and services and in some circumstances, to comply with the requirements of the law and/or regulations.

As the Company processes personal information regarding individuals (data subjects), we are obligated under the General Data Protection Regulation (GDPR) to protect such information, and to obtain, use, process, store and destroy it, only in compliance with the GDPR and its principles.

The General Data Protection Regulation

The General Data Protection Regulation (GDPR) gives individuals the right to know what information is held about them, to access this information and to exercise other rights, including the rectification of inaccurate data. The GDPR is a standardised regulatory framework which ensures that personal information is obtained, handled and disposed of properly.

As the Company are obligated under the GDPR and UK data protection laws, we abide by the Regulations’ principles, which ensure that personal information shall be: –

processed lawfully, fairly and in a transparent manner in relation to the data subject

collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes

adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed

accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay

kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed

processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures

The Regulation also requires that ‘the controller shall be responsible for, and be able to demonstrate, compliance with the GDPR principles’ The Company have adequate and effective measures, controls and procedures in place, that protect and secure your personal information and guarantee that it is only ever obtained, processed and disclosed in accordance with the relevant data protection laws and regulations.

What is Personal Information?

Information protected under the GDPR is known as “personal data” and is defined as: –

“Any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.”

Further information on what constitutes personal information and your rights under the data protection regulation and laws can be found on the Information Commissioners Office (ICO) website.

The Right of Access

Under Article 15 of the GDPR, an individual has the right to obtain from the controller, confirmation as to whether or not personal data concerning them is being processed. We are committed to upholding the rights of individuals and have dedicated processes in place for providing access to personal information. Where requested, we will provide the following information: –

the purposes of the processing

the categories of personal data concerned

the recipient(s) or categories of recipient(s) to whom the personal data have been or will be disclosed

the envisaged period for which the personal data will be stored

where the personal data was not collected directly from the individual, any available information as to its source

How To Make a Subject Access Request (SAR)?

A subject access request (SAR) is a request for access to the personal information that the Company holds about you, which we are required to provide under the GDPR. The information that we provide is covered in section 3 of this document.

You can make this request in writing using the details provided in section 7, or you can submit your access request electronically. Where a request is received by electronic means, we will provide the requested information in a commonly used electronic form

What We Do When We Receive An Access Request

Identity Verification

Subject Access Requests (SAR) are passed to the Compliance Officer as soon as received and a record of the request is made. The person in charge will use all reasonable measures to verify the identity of the individual making the access request, especially where the request is made using online services.

We will utilise the request information to ensure that we can verify your identity and where we are unable to do so, we may contact you for further information, or ask you to provide evidence of your identity prior to actioning any request. This is to protect your information and rights.

If a third party, relative or representative is requesting the information on your behalf, we will verify their authority to act for you and again, may contact you to confirm their identity and gain your authorisation prior to actioning the any request.

Information Gathering

If you have provided enough information in your SAR to collate the personal information held about you, we will gather all documents relating to you and ensure that the information required is provided in an acceptable format. If we do not have enough information to locate your records, we may contact you for further details. This will be done as soon as possible and within the timeframes set out below.

Information Provision

Once we have collated all the personal information held about you, we will send this to you in writing or in a commonly used electronic form if requested. The information will be in a concise, transparent, intelligible and easily accessible format, using clear and plain language.

Fees and Timeframes

Whilst we provide the information requested without a fee, further copies requested by the individual may incur a charge to cover our administrative costs.

The Company always aim to provide the requested information at the earliest convenience, but at a maximum, 30 days from the date the request is received. However, where the retrieval or provision of information is particularly complex or is subject to a valid delay, the period may be extended by two further months. If this is the case, we will write to you within 30 days and keep you informed of the delay and provide the reasons.

Your Other Rights

Under the GDPR, you have the right to request rectification of any inaccurate data held by us. Where we are notified of inaccurate data, and agree that the data is incorrect, we will amend the details immediately as directed by you.

We will rectify any errors within 30-days and inform you in writing of the correction and where applicable, provide the details of any third-party to whom the data has been disclosed.

If for any reason, we are unable to act in response to a request for rectification and/or data completion, we will always provide a written explanation to you and inform you of your right to complain to the Supervisory Authority and to seek a judicial remedy.

In certain circumstances, you may also have the right to request from the Company, the erasure of personal data or to restrict the processing of personal data where it concerns your personal information; as well as the right to object to such processing. You can use the contact details in section 7 to make such requests.

Exemptions and Refusals

The GDPR contains certain exemptions from the provision of personal information. If one or more of these exemptions applies to your subject access request or where the Company does not act upon the request, we shall inform you at the earliest convenience, or at the latest, within one month of receipt of the request.

Where possible, we will provide you with the reasons for not acting and any possibility of lodging a complaint with the Supervisory Authority and your right to seek a judicial remedy. Details of how to contact the Supervisory Authority are laid out in section 7 of this document.

Submission & Lodging a Complaint

To submit your SAR you can submit your request in writing using the form in Appendix 1, and send to: –

Under the General Data Protection Regulation, you are entitled as a data subject to obtain from the Company, confirmation as to whether or not we are processing personal data concerning you, as well as to request details about the purposes, categories and disclosures of such data. To request this form, please contact Jo@conceptpersonnel.com.

We connect talent with opportunity. Concept are a creative and digital recruitment agency in the North East, Scotland and Milton Keynes.

Contacts

When I first started out as a graphic designer Steph gave me invaluable advise on what I needed to do to get started and what to do if I wanted to work in an agency in future. After three years of freelance work I went back to Concept and Erin helped me get my first agency job! Which I love! They were fantastic! I can't recommend them enough, and they were always on hand with honest and helpful advise about what I needed to do going forward.

Clare Brown

09:42 19 Feb 19

My experience with Concept Personnel has been great and speaking direct with Managing Director, Jo has been a valuable experience. Jo was super helpful in the recruitment process, giving me tips for the interview and always on hand to answer any queries I had.
If you are looking for a recruitment agency who knows what they are talking about when it comes to all things Design & Digital, be sure to speak to the Concept Personnel team!

Jordan Kwok

09:14 03 Aug 18

Thank you Jo at Concept Personnel, who has been very patient, kind and supportive throughout the entire recruitment process. In fact, my case had been going on almost a year, but we got there in the end. A big thank you once again.

MUFCMATTY11 11

21:06 14 Mar 18

I had a fantastic experience using Concept Personnel. Erin was amazing, she kept me updated throughout the interview process and was always on hand if I had any questions. Would highly recommend A+++++++

Ri C

16:19 04 Feb 18

Thank you to Jo and Concept Personnel for a truly excellent, responsive and supportive experience. I was very impressed with the clear and detailed communication throughout the process. Jo’s friendly and easy to work with approach means I would not hesitate to recommend them to other potential candidates.

Jade Lambourne

16:53 25 Nov 17

Having recently gotten a new job through Concept Personnel, I would strongly recommend them to any other candidates looking for the next challenge in their career. I dealt with Erin who was personable, supportive and genuinely pleased for my success. Brilliant experience from start to finish.

Lauren M

20:24 31 Oct 17

Erin was fantastic throughout the whole process, giving me advice along the way and reassuring me with any concerns I had. I now have an amazing job doing exactly what I want - thank you!

Scott Shannon

17:56 28 Oct 17

Erin and all the other guys at Concept were great. Erin completely understood the direction in which I wanted to take my career and found the perfect position for me. Erin kept in regular contact with myself and offered plenty of advice throughout my job seeking process. I would certainly recommend Concept to anyone seeking employment in the creative sector.